Privacy Policy

Undrop ("Undrop," "we," "us") is operated by a solo, Philippines-based developer. This page explains what we collect when you use the Undrop service — the MCP proxy, dashboard, and related tools — and why. If something here is unclear, email hello@undrop.dev and ask; that goes to the person who wrote this policy, not a support queue.

The short version

We log the SQL statements your agent sends and the row counts they affect, so we can classify and show you what was blocked. We do not log, cache, or persist query result sets — the actual rows your database returns pass through to your agent and are never written to disk on our side. That's an architectural boundary, not a promise we could quietly walk back: the gateway process that proxies your queries holds no object-storage credentials, so there is nowhere for a result set to go even if we wanted to keep one.

What we collect

Account information

Email address and authentication data when you sign up. If you pay for Pro, billing details are collected and processed by Creem, our merchant of record — we receive a customer and subscription identifier, never your card number.

Database connection details

When you connect a Supabase project, we store a scoped Postgres credential (never your service_role key — the connect flow rejects it outright) encrypted at rest. In Lockdown mode, we also hold the rotated database password that replaces your original one.

Statements, reasons, and row counts

Every statement your agent sends through the proxy is classified (allowed, blocked-destructive, blocked-unknown) and the classification, the reason codes, and affected-table row counts are stored so the approval screen and your activity timeline can show them to you. The exact statement text for a blocked statement is stored so you can review it before approving — this is the same text your agent sent, never a summary or a re-parse.

Snapshots

Before a destructive statement runs (including ones you approve), we take a scoped pg_dump snapshot of the affected tables. Snapshots are encrypted at rest and stored in object storage (Cloudflare R2), with a default region and an EU-jurisdiction option you can choose at connect time. Snapshots are standard pg_dump archives — exportable at any time, not a proprietary format we could hold hostage.

What we don't collect

Query result sets. The contents of tables we haven't snapshotted. Your agent's conversation with you or with its model provider — Undrop sees the SQL your agent decided to run, nothing upstream of that decision.

Who else sees it

We use a small number of infrastructure providers to run the service, each with access limited to what their function requires:

• Creem — payment processing and merchant-of-record billing.
• Cloudflare R2 — encrypted snapshot storage.
• AWS KMS — encryption key management for credentials and snapshots.
• Resend — transactional email (approval notifications, the weekly digest).
• BetterStack — uptime monitoring and the public status page.
• Sentry — application error tracking, configured to scrub SQL statement bodies before an error report leaves our infrastructure.

We don't sell data, and we don't share it for advertising.

Retention

Snapshot retention follows your plan: Free keeps your last three risk-point snapshots or 24 hours of history, whichever is more; Pro keeps 30 days. If you cancel Pro, existing snapshots remain downloadable for 30 days before deletion. If you delete your account, snapshots and stored credentials are purged within 7 days, and we email confirmation once that's done.

Your rights

You can export everything — every snapshot archive, as a tarball, with a manifest — from the dashboard at any time, not just at cancellation. You can request access to, correction of, or deletion of your account data by emailing hello@undrop.dev. If you or your end users are in the EU/EEA, a Data Processing Agreement is available on request, and you can choose EU-region storage for snapshots at connect time.

Security

Credentials and snapshots are encrypted at rest via envelope encryption (AWS KMS). Database roles Undrop creates are scoped to the minimum grants needed for the proxy and snapshot engine to work, and we explicitly revoke access to Supabase's auth and storage schemas rather than relying on default grants. If our control plane goes down, write operations fail closed — an outage on our end never means an unprotected agent.

Children's privacy

Undrop is a developer tool and is not directed at, or knowingly used to collect information from, children.

Changes to this policy

If this policy changes in a way that affects what we collect or how we use it, we'll email account holders and update the date at the top of this page.

Contact

Questions about this policy: hello@undrop.dev.